disallow $a[] = value syntax

diff --git a/ext/spl/spl_fastarray.c b/ext/spl/spl_fastarray.c
index ae1129c1eca1c22a4ea4970c30b1ee22836dbc4d..6449f0ddc2796581e153b4f1195a45703c6794cf 100644 (file)
--- a/ext/spl/spl_fastarray.c
+++ b/ext/spl/spl_fastarray.c
@@ -321,6 +321,12 @@ static inline void spl_fastarray_object_write_dimension_helper(spl_fastarray_obj
 {
        long index;
 
+       if (!offset) {
+               /* '$array[] = value' syntax is not supported */
+               zend_throw_exception(spl_ce_RuntimeException, "Index invalid or out of range", 0 TSRMLS_CC);
+               return;
+       }
+
        index = spl_offset_convert_to_long(offset TSRMLS_CC);
 
        if (index < 0 || index >= intern->array->size) {